This chapter describes issues associated with Web services development, security, and administration, including Oracle Web Services Manager.
It includes the following topics:
Using Multibyte User Credentials with wss_http_token_* Policy
Fusion Middleware Control Does Not List Policies When Two Servers Are SSL Enabled (Two-way SSL)
Web Service Test Page Cannot Test Input Arguments Bound to SOAP Headers
Security Policies Do Not Work on Subscriber Mediator Component
Policy Table Might Not Show Attached Policies for Some Locales
Do Not Attach a Permitall and Denyall Policy to the Same Web Service
Bulk Attachment of Policies Is not Supported In the Current Release
Enterprise Manager Returns You to the OWSM Policies Page After Editing a Client Policy
An NPE Can be Thrown If STS Certificate Is Missing from Signed SAML Token
Cross-Domain Policy Manager Configuration Is Not Supported In this Release
OWSM Introspection Plug-in Fails When Proxy Is Configured Incorrectly
Test Web Service Page Does Not Save Loaded Payloads In the Correct Format
Incompatible Policies Listed for Web Services and Clients Using SOAP Over JMS Transport
Unsupported Make Connection Policy/ Assertion Template Category Shown In Fusion Middleware Control
Note:
For WebLogic Web Services, see "Web Services and XML Issues and Workarounds" in the Oracle Fusion Middleware Release Notes for Oracle WebLogic Server.In this release, multibyte user credentials are not supported for the wss_http_token_* policies. If multibyte user credentials are required, use a different policy, such as wss_username_token_* policy. For more information about the available policies, see "Predefined Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
When performing a bulk import of policies to the MDS repository, if the operation does not succeed initially, retry the operation until the bulk import succeeds.
For the most part, this can occur for an Oracle RAC database when the database is switched during the metadata upload. If there are n databases in the Oracle RAC database, then you may need to retry this operation n times.
For more information about bulk import of policies, see "Migrating Policies" in the Administering Web Services.
When the connections.xml file is changed after deployment using the AdfConnection MBean, the complete connection is saved as a customization. This means that changes to the connection in a redeployed application are overwritten by the customization.
When you use Fusion Middleware Control to make changes to an application's connections.xml file after deployment, a new connections.xml file is created as a customization and stored in the MDS repository. This customization persists for the life of the application. Therefore, if you redeploy the application, the customized connections.xml file continues to be applied as a customization on the application.
To allow the redeployed application's connections.xml file to be applied without the prior customization (from Fusion Middleware Control), you must explicitly remove the connections.xml customizations from the MDS repository.
For example, if you deploy an application with a Web services data control, then use Fusion Middleware Control to attach the username_token_client_policy, and subsequently detach the policy. Then, you return to JDeveloper to edit the application and attach the http_token_client_policy, and redeploy the application. When you view the application using Fusion Middleware Control, you see that it is not using the http_token_client_policy that you attached. That is because it is using the customized connections.xml file that you previously created using Fusion Middleware Control.
If you remove the connections.xml customizations from the MDS repository, the application will use the its own connections.xml file.
The following information is supported in English only in this release of Oracle Enterprise Manager:
All fields in the policy and assertion template except the orawsp:displayName field.
If using the ?orawsdl browser address, the orawsp:description field.
When a Managed Server is Two-way enabled SSL (for example, a SOA server hosting OWSM Policy Manager over Two-way SSL) and the Administration Server hosting Fusion Middleware Control is correctly configured to access the Two-way SSL-enabled Managed Server, Fusion Middleware Control still does not list the OWSM policies.
For Web services that have any input arguments bound to SOAP headers, the Test Web Service page in the Fusion Middleware Control console cannot show the message. Therefore, such operations cannot be tested with the Test Web Service page.
For example, if the input for a multi-part WSDL is viewed through Fusion Middleware Control, and one input argument is bound to a SOAP header, the composite instance fails with the following exception because the other part of the message was missing in the input:
ORAMED-01203:[No Part]No part exist with name "request1" in source message
To resolve such an issue, select XML View for Input Arguments and edit the payload to pass input for both parts of the WSDL.
In some cases, there can be a limitation when using custom Exactly-one policies. For a set of assertions within the exactly-one policy, if a request message satisfies the first assertion, then the first assertion gets executed and a response is sent accordingly. However, this may not be the desired behavior in some cases because the request may be intended for the subsequent assertions.
For example, you may have a client policy that has Timestamp=ON and a service exactly-one policy that has a wss11 username token with message protection assertions: the first has Timestamp=OFF; the second has Timestamp=ON. Therefore, the first assertion in the service exactly-one policy is not expecting the Timestamp in the request, yet the second assertion does expect it. In this case, the first assertion gets executed and the response is sent with no Timestamp. However, the client-side processing then fails because it expects the Timestamp that was sent in the request.
This limitation can exist with any cases where a client policy expects a greater number of elements to be signed and a service policy does not.
Component Authorization denyall policy does not work at subscriber mediator component. Authorization policy works for other normal mediator component cases.
Select the Web service application in Fusion Middleware Control and navigate to the Web service endpoint. Attach a policy to the endpoint in the Attach/Detach page. Sometimes the Directly Attached Polices table might not display the attached policies for the following locales: zh-cn, zh-tw, ja, pt-br, es, fr, ko.
As a workaround, enlarge the columns.
Although you can attach multiple authorization policies to the same Web service, you should not attach both a permitall and denyall policy. If you do so, however, the combination validates successfully in this release.
Workaround:
Do not attach a permitall and denyall policy to the same Web service. For more information about authorization policies, see "Configuring Authorization" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
If a policy that is being referred to by a Web Service is deleted and then re-imported, then its usage count will not be correct and application(s) must be restarted to obtain an accurate usage count.
Performance improvements have been made to the Web Services Policy pages in Fusion Middleware Control by removing the unnecessary role query.
Attaching one or more policies to one or more Web services using the bulk attachment feature is not supported in the current release. Please use the Policy Set feature instead. For more information on Policy Sets, see "Attaching Policies Globally Using Policy Sets Using WLST" and "Schema Reference for Policy Sets" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
When you generate client policies in Enterprise Manager, the Generate Client Policies page is displayed and the generated policies are shown as Not saved. Once you save the policies, and then edit one of them, you are returned to the OWSM Policies page. This is an error in Enterprise Manager. You should be returned to the Generate Client Policies page.
To edit additional policies, use the search feature in the OWSM Policies page to locate the client policy you wish to edit.
For more information, see "Generating Client Policies from a WSDL" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
If you configure the OWSM keystore for KSS and then attempt to configure the JKS keystore, the Path field and the Key menus in the JKS configuration screen are populated with the values for the KSS keystore.
Workaround: Clear the Path and Key fields in the JKS configuration screen before configuring the JKS keystore. For information on configuring JKS keystore in OWSM, see "Configuring OWSM to Use the JKS Keystore" in Securing Web Services and Managing Policies with Oracle Web Services Manager
If the Policy Manager URL is configured as a classpath, then domain-level configuration is not supported. All domain-level configuration information is stored in the OWSM repository, and not the JAR file that is included in the classpath. For information about configuring the Policy Manager URL, see the following sections in Securing Web Services and Managing Policies with Oracle Web Services Manager:
If you wish to manage domain-level configuration, configure the Policy Manager URL to specify a remote domain or use auto mode. Once you have configured the new Policy Manager URL mode, you must restart the server for it to take effect.
When editing the SAML trusted issuers and DN lists on the Authentication tab of the OWSM Domain Configuration page, as described in "Configuring SAML Trusted Issuers and DN Lists Using FMC" in Securing Web Services and Managing Policies with Oracle Web Services Manager, the Apply and Revert buttons are not activated until you edit another field on the page. If necessary, make "dummy" edits in another field to activate the buttons.
"Using the Query by Example Filter" (for Web Service policies) and "Using the Query by Example Filter" (for assertion templates) in Securing Web Services and Managing Policies with Oracle Web Services Manager describe how to search for policies and assertion templates by querying on a specific field. This feature is not working in the current release.
Workaround: To work around this issue, use the advanced search utility as described in "Using Advanced Search" (for Web Service policies) and in "Using Advanced Search" (for assertion templates) in Securing Web Services and Managing Policies with Oracle Web Services Manager.
By default, Oracle Security Token Service (OSTS) does not include an STS signing certificate inside the signed SAML token returned from STS. If OWSM encounters a signed token without an STS certificate inside a SAML signature, then it throws a NullPointerException (NPE).
Workaround: To work around this problem, ensure that an STS certificate is present in the signed SAML token. For information on configuring a policy for STS, see "Setting Up Automatic Policy Configuration for STS" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
In past releases, OWSM sent different fault codes (for example, FailedAuthentication, InvalidSecurityToken, FailedCheck, and so on) for different error cases In the current release, this default behavior has been changed. OWSM now sends the InvalidSecurity fault code for all error cases. This has been done to avoid XML encryption attacks. An encryption attack is possible if the service sends different fault codes for different types of errors (for example, FailedAuthentication, InvalidSecurityToken, FailedCheck, and so on).This default behavior can be changed by setting the domain-wide agent property use.unified.fault.code to false. However, this is not recommended, because it might allow XML encryption attacks. The default value for this property, "true", will cause OWSM to send the InvalidSecurity fault code for all error cases. For more information on the use.unified.fault.code property, see "Configuring Security Policy Enforcement Using WLST" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
In this release, configuration to a Policy Manager in a remote domain is not supported.
OWSM provides an introspection plug-in for Oracle Virtual Assembly Builder, which is a tool for virtualizing installed Oracle components, modifying those components, and then deploying them into an Oracle VM environment. For more information, see "OWSM Introspection Plug-in for Oracle Virtual Assembly Builder" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
The OWSM introspection plug-in executes when you introspect a WebLogic domain using the abctl introspectWLS12 command or Oracle Virtual Assembly Builder Studio (abstudio.sh). This introspection may fail in the following conditions:
When the Administration Server listen address is configured to listen on a particular address that is different than localhost.
Workaround:
Clear the Administration Server listen address in the Administration Console to enable the local address to be in effect, as described in "Configure listen address" in Oracle WebLogic Server Administration Console Online Help.
Set the Administration Server listen address to localhost.
When proxy setting is performed during introspection. This introspection may fail when a proxy server is required in your networking environment and no proxy configuration is available to the tool being used to perform the introspection (for example, abctl or abstudio.sh).
Workaround:
If you are introspecting using abstudio.sh, you must bypass the proxy setting for localhost. Please consult the Release Notes for Oracle Virtual Assembly Builder for information about configuring the proxy.
If you are introspecting with abctl, use the standard proxy configuration properties for Java applications. Before issuing the abctl command, set the properties in your environment using the SYSPROPS environment variable to bypass the proxy setting for localhost. For example, use one of the following commands, based on your shell:
csh: setenv SYSPROPS '-Dhttp.proxyHost=myProxyHost -Dhttp.proxyPort=NN -Dhttp.nonProxyHosts=localhost|n.n.n.n
sh/bash/ksh: export SYSPROPS '-Dhttp.proxyHost=myProxyHost -Dhttp.proxyPort=NN -Dhttp.nonProxyHosts=localhost|n.n.n.n
Note:
The actual proxy settings will be specific to your environment.This bug impacts the reissue of the secure conversation token (SCT). The SCT is reissued when a BadContextToken fault is received at client side. However, due to this bug, the client does not clear its cache and continues to send the same token until the token expires.
This situation can happen when the client has a valid token and the service does not have the same token in the session manager. If service side persistence is not enabled and the server goes down, then it will not have the session IDs then the server resumes. As a result, client requests will fail. Normally, the client-side cache is cleared when the BadContextToken fault is received, but due to unified fault code, the client will receive a different fault code.
The workaround is to disable unified fault code. For more information on the use.unified.fault.code option, see "Configuring Security Policy Enforcement Using WLST" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
Table 7-1 lists the WLST commands for Oracle Infrastructure Web Services (or clients) that were available in Oracle Fusion Middleware 11g release and which have been deprecated in 12c (12.1.2). In addition, the table lists the new WLST command equivalent and provides an example of how you can update your code use the new command.
For more information about the WLST commands, see "Web Services Custom WLST Commands" in Oracle Fusion Middleware WLST Command Reference for Infrastructure Components.
Table 7-1 Deprecated Commands for Oracle Infrastructure Web Services
| Deprecated Command (11g) | Recommended Command (12c) | Updating Your Code |
|---|---|---|
|
|
|
11g Release (for Repository operations):
wls:/jrfServer_domain/serverConfig> abortRepositorySession()
12c Release (for both Repository and PolicySubject operations):
wls:/jrfServer_domain/serverConfig> abortWSMSession()
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> attachPolicySet ('Domain("base_domain")')
12c Release:
wls:/jrfServer_domain/serverConfig> setWSMPolicySetScope ('Domain("base_domain")')
|
|
|
|
11g Release (for both Repository and PolicySubject operation on policy set):
wls:/jrfServer_domain/serverConfig> attachPolicySetPolicy ('oracle/wss_username_token_service_policy')
12c Release: wls:/jrfServer_domain/serverConfig> attachWSMPolicy('oracle/wss_username_token_service_policy') wls:/wls-domain/serverConfig>attachWSMPolicies(["oracle/wss_username_token_client_policy","oracle/log_policy"]) |
|
|
|
11g Release (for Repository operations):
wls:/jrfServer_domain/serverConfig> beginRepositorySession()
12c Release (for both Repository and PolicySubject operations):
wls:/jrfServer_domain/serverConfig> beginWSMSession()
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> clonePolicySet ('myNewPolicySet', 'myPolicySet')
12c Release:
wls:/jrfServer_domain/serverConfig> cloneWSMPolicySet ('myNewPolicySet', 'myPolicySet')
|
|
|
|
11g Release (for Repository operations):
wls:/jrfServer_domain/serverConfig> commitRepositorySession()
12c Release (for both Repository and PolicySubject operations):
wls:/jrfServer_domain/serverConfig> commitWSMSession()
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> createPolicySet('myPolicySet', 'ws-service', 'Domain("base_domain")')
12c Release:
wls:/jrfServer_domain/serverConfig> createWSMPolicySet ('myPolicySet', 'ws-service', 'Domain("base_domain")')
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> deletePolicySet('myPolicySet')
12c Release:
wls:/jrfServer_domain/serverConfig> deleteWSMPolicySet ('myPolicySet')
|
|
|
|
11g Release (for Repository operations):
wls:/jrfServer_domain/serverConfig> describeRepositorySession()
11g Release (for PolicySubject operations): N/A 12c Release (for both Repository and PolicySubject operations):
wls:/jrfServer_domain/serverConfig> describeWSMSession()
|
|
|
|
11g Release (for both Repository and PolicySubject operation on policy set):
wls:/jrfServer_domain/serverConfig> detachPolicySet ('oracle/wss_username_token_service_policy')
12c Release: wls:/jrfServer_domain/serverConfig> detachWSMPolicy('oracle/wss_username_token_service_policy') wls:/wls-domain/serverConfig>detachWSMPolicies(["oracle/log_policy","oracle/wss_username_token_client_policy"]) |
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> displayPolicySet('myPolicySet')
12c Release:
wls:/jrfServer_domain/serverConfig> displayWSMPolicySet ('myPolicySet')
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> enablePolicySet(true)
12c Release:
wls:/jrfServer_domain/serverConfig> enableWSMPolicySet(true)
|
|
|
|
11g Release:
wls:/wls-domain/serverConfig>enablePolicySetPolicy('/oracle/log_policy',false)
12c Release: wls:/wls-domain/serverConfig>enableWSMPolicy('/oracle/log_policy',false) wls:/wls-domain/serverConfig>enableWSMPolicies(["oracle/log_policy", "oracle/wss_username_token_client_policy"], true ) |
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> exportRepository ("/tmp/repo.zip")
12c Release:
wls:/jrfServer_domain/serverConfig> exportWSMRepository ("/tmp/repo.zip")
|
|
|
|
11g Release (for repository documents):
wls:/jrfServer_domain/serverConfig> importRepository ("/tmp/repo.zip")
12c Release (for repository documents):
wls:/jrfServer_domain/serverConfig> importWSMArchive ("/tmp/repo.zip")
|
|
|
|
11g Release:
wls:/wls-domain/serverConfig>listPolicySets('sca-reference')
12c Release:
wls:/wls-domain/serverConfig>listWSMPolicySets('sca-reference')
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> migrateAttachments()
12c Release:
wls:/jrfServer_domain/serverConfig> migrateWSMAttachments()
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> modifyPolicySet('myPolicySet')
12c Release:
wls:/jrfServer_domain/serverConfig> selectWSMPolicySet ('myPolicySet')
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> resetWSMPolicyRepository()
12c Release:
wls:/jrfServer_domain/serverConfig> resetWSMRepository()
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> setPolicySetConstraint ('HTTPHeader("VIRTUAL_HOST_TYPE","external")')
12c Release:
wls:/jrfServer_domain/serverConfig> setWSMPolicySetConstraint ('HTTPHeader("VIRTUAL_HOST_TYPE","external")')
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> setPolicySetDescription ('Global policy set for web service endpoint.')
12c Release:
wls:/jrfServer_domain/serverConfig> setWSMPolicySetDescription ('Global policy set for web service endpoint.')
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> setWebServicePolicyOverride ('/base_domain/server1/HelloWorld#1_0','j2wbasicPolicy', 'web', '{http://namespace/}WssUsernameService','JRFWssUsernamePort', 'oracle/wss_username_token_service_policy', 'reference.priority', '10')
12c Release:
wls:/jrfServer_domain/serverConfig> setWSMPolicyOverride ('oracle/wss_username_token_service_policy', 'reference.priority', '10')
|
|
|
|
11g Release (for both Repository and PolicySubject operation on policy set):
wls:/jrfServer_domain/serverConfig> setPolicySetPolicyOverride ('oracle/wss_username_token_service_policy', 'reference.priority', '10')
12c Release:
wls:/jrfServer_domain/serverConfig> setWSMPolicyOverride ('oracle/wss_username_token_service_policy', 'reference.priority', '10')
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> upgradeWSMPolicyRepository()
12c Release:
wls:/jrfServer_domain/serverConfig> upgradeWSMRepository()
|
|
|
|
11g Release:
wls:/jrfServer_domain/serverConfig> validatePolicySet ('myPolicySet')
12c Release:
wls:/jrfServer_domain/serverConfig> validateWSMPolicySet ('myPolicySet')
|
In Fusion Middleware Control, when testing a SOAP web service on the Test Web Service page, the Import Payload option does not generate the correct date/date time type patterns when importing a payload XML file, as follows:
Tree View – The date time value is always formatted to a US pattern, such as Tue Dec 30 00:00:00 PST 2014, when the correct pattern should be YYYY-MM-ddTHH:mm:ss or YYYY-MM-dd.
XML View – The server time zone is always incorrectly appended to the date, such as 2014-12-30-08:00, which is not part of the imported value.
Workaround:
Clear the imported date and date time values, and then manually enter the correct values before submitting the payload.
In Fusion Middleware Control, when testing a SOAP web service on the Test Web Service page, the Save Payload option incorrectly saves the loaded payload in Server Locale format (ISO-8859-1) instead of in UTF-8 format.
Using the automatic policy configuration for STS (Security Token Service) in OWSM may not result in a compatible policy.
Workaround:
You should manually configure the STS config policy from a web service client, as described in "Manually Configuring the STS Config Policy From the Web Service Client: Main Steps" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
When attaching policies globally using policy sets, certain inherited authorization policies can result in conflicting behavior. For example, these globally attached policy sets have a security category and each contain an assertion with security/authorization category:
Domain-level global policy attachment on a SOAP proxy service: oracle/whitelist_authorization_policy
Application-level global policy attachment on a SOAP proxy service: oracle/no_authorization_service_policy
For those categories that fall into the list of categories that cannot be attached on the same subject multiple times, these global policy attachments would have resulted in a conflict, with the application-level global policy attachment taking precedence. However, given that policies with a security/authorization category can be attached to a subject multiple times, the effective policy set in this example consists of both oracle/whitelist_authorization_policy and oracle/no_authorization_service_policy attachments, and this behavior is incorrect because these two authorization policies result in conflicting behavior.
Another example would be having a binding_authorization_denyall_policy, and then allowing another authorization policy, such as binding_authorization_permitall_policy, which is also not acceptable because it results in conflicting behavior. Just as in the first example, where the oracle/no_authorization_service_policy and oracle/whitelist_authorization_policy should not be allowed to co-exist in the same global policy attachment.
For more information, see "Global Policy Attachments Using Policy Sets" in Understanding Oracle Web Services Manager.
In Fusion Middleware Control, when attaching OWSM policies to web services and clients that use SOAP over JMS transport, the list of available policies includes those that are not compatible.
For a list of compatible policies, refer to "Which OWSM Policies Are Supported for Web Services and Clients That Use SOAP Over JMS Transport" in Securing Web Services and Managing Policies with Oracle Web Services Manager.
When using SPNEGO policy enforcement for REST web services, if a web service client does not have the SPNEGO policy attached but the web service does use SPNEGO, an incorrect OK 200 response status is generated. The logs correctly show the error as expected, but the user should receive an error with an Unauthorized 401 response status.
In Fusion Middleware Control, the Make Connection category for OWSM policies and Assertion templates is included in the search drop-down menus on the WSM Policies and Assertion Template page. However, this category is not supported and should not be displayed.
Certain web browsers, such as Apple's Safari, attempt to interpret the WSDL source when you click a WSDL link, and therefore will display a blank page.
Workaround:
In order to view the WSDL source with such browsers, you need to use the browser's View Source command on the blank page. You can right-click on the blank page and click View Page Source to view the content.